CVE-2026-35148 — HCL DFXServer is affected by a Missing Access Control vulnerability

CVE-2026-35148

HCL DFXServer is affected by a Missing Access Control vulnerability PUBLISHED

Description (CNA)

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.

Affected (CNA)

Vendor / product	Versions
HCL Software / DFXServer	affected version 2.5 and below

CWE

CWE-284

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.